?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
flowtop: Add process UI tab entry
[netsniff-ng.git] / flowtop.c
blob2491de71e52c97fc1a82e88884307e85946851f9
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * Copyright 2011 - 2013 Daniel Borkmann.
4 * Copyright 2011 Emmanuel Roullit.
5 * Subject to the GPL, version 2.
6 */
7
8 #define _LGPL_SOURCE
9 #include <stdio.h>
10 #include <stdint.h>
11 #include <stdlib.h>
12 #include <signal.h>
13 #include <getopt.h>
14 #include <pthread.h>
15 #include <signal.h>
16 #include <netdb.h>
17 #include <ctype.h>
18 #include <netinet/in.h>
19 #include <curses.h>
20 #include <sys/time.h>
21 #include <sys/fsuid.h>
22 #include <libgen.h>
23 #include <inttypes.h>
24 #include <poll.h>
25 #include <fcntl.h>
26 #include <arpa/inet.h>
27
28 #include <urcu.h>
29 #include <urcu/list.h>
30 #include <urcu/rculist.h>
31
32 #include "ui.h"
33 #include "die.h"
34 #include "xmalloc.h"
35 #include "conntrack.h"
36 #include "config.h"
37 #include "str.h"
38 #include "sig.h"
39 #include "lookup.h"
40 #include "geoip.h"
41 #include "built_in.h"
42 #include "pkt_buff.h"
43 #include "screen.h"
44 #include "proc.h"
45 #include "sysctl.h"
46
47 #ifndef NSEC_PER_SEC
48 #define NSEC_PER_SEC 1000000000L
49 #endif
50
51 #ifndef USEC_PER_SEC
52 #define USEC_PER_SEC 1000000L
53 #endif
54
55 struct proc_entry {
56 struct cds_list_head entry;
57 struct cds_list_head flows;
58 struct rcu_head rcu;
59
60 struct timeval last_update;
61 unsigned int pid;
62 char name[256];
63 uint64_t pkts_src, bytes_src;
64 uint64_t pkts_dst, bytes_dst;
65 double rate_bytes_src;
66 double rate_bytes_dst;
67 double rate_pkts_src;
68 double rate_pkts_dst;
69 int flows_count;
70 };
71
72 struct flow_entry {
73 struct cds_list_head proc_head;
74 struct cds_list_head entry;
75 struct rcu_head rcu;
76
77 uint32_t flow_id, use, status;
78 uint8_t l3_proto, l4_proto;
79 uint32_t ip4_src_addr, ip4_dst_addr;
80 uint32_t ip6_src_addr[4], ip6_dst_addr[4];
81 uint16_t port_src, port_dst;
82 uint8_t tcp_state, tcp_flags, sctp_state, dccp_state;
83 uint64_t pkts_src, bytes_src;
84 uint64_t pkts_dst, bytes_dst;
85 uint64_t timestamp_start, timestamp_stop;
86 char country_src[128], country_dst[128];
87 char country_code_src[4], country_code_dst[4];
88 char city_src[128], city_dst[128];
89 char rev_dns_src[256], rev_dns_dst[256];
90 struct proc_entry *proc;
91 int inode;
92 bool is_visible;
93 struct nf_conntrack *ct;
94 struct timeval last_update;
95 double rate_bytes_src;
96 double rate_bytes_dst;
97 double rate_pkts_src;
98 double rate_pkts_dst;
99 };
100
101 struct flow_list {
102 struct cds_list_head head;
103 };
104
105 struct proc_list {
106 struct cds_list_head head;
107 };
108
109 enum flow_direction {
110 FLOW_DIR_SRC,
111 FLOW_DIR_DST,
112 };
113
114 #ifndef ATTR_TIMESTAMP_START
115 # define ATTR_TIMESTAMP_START 63
116 #endif
117 #ifndef ATTR_TIMESTAMP_STOP
118 # define ATTR_TIMESTAMP_STOP 64
119 #endif
120
121 #define SCROLL_MAX 1000
122
123 #define INCLUDE_IPV4 (1 << 0)
124 #define INCLUDE_IPV6 (1 << 1)
125 #define INCLUDE_UDP (1 << 2)
126 #define INCLUDE_TCP (1 << 3)
127 #define INCLUDE_DCCP (1 << 4)
128 #define INCLUDE_ICMP (1 << 5)
129 #define INCLUDE_SCTP (1 << 6)
130
131 #define TOGGLE_FLAG(what, flag) \
132 do { \
133 if (what & flag) \
134 what &= ~flag; \
135 else \
136 what |= flag; \
137 } while (0)
138
139 struct sysctl_params_ctx {
140 int nfct_acct;
141 int nfct_tstamp;
142 };
143
144 enum rate_units {
145 RATE_BITS,
146 RATE_BYTES
147 };
148
149 static volatile bool do_reload_flows;
150 static volatile bool is_flow_collecting;
151 static volatile sig_atomic_t sigint = 0;
152 static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP;
153 static struct proc_list proc_list;
154 static struct flow_list flow_list;
155 static struct sysctl_params_ctx sysctl = { -1, -1 };
156
157 static unsigned int cols, rows;
158 static WINDOW *screen;
159 static int skip_lines;
160
161 static unsigned int interval = 1;
162 static bool show_src = false;
163 static bool resolve_dns = true;
164 static bool resolve_geoip = true;
165 static enum rate_units rate_type = RATE_BYTES;
166 static bool show_active_only = false;
167
168 enum tbl_flow_col {
169 TBL_FLOW_PROCESS,
170 TBL_FLOW_PID,
171 TBL_FLOW_PROTO,
172 TBL_FLOW_STATE,
173 TBL_FLOW_TIME,
174 TBL_FLOW_ADDRESS,
175 TBL_FLOW_PORT,
176 TBL_FLOW_GEO,
177 TBL_FLOW_BYTES,
178 TBL_FLOW_RATE,
179 };
180
181 enum tbl_proc_col {
182 TBL_PROC_NAME,
183 TBL_PROC_PID,
184 TBL_PROC_FLOWS,
185 TBL_PROC_BYTES_SRC,
186 TBL_PROC_RATE_SRC,
187 TBL_PROC_BYTES_DST,
188 TBL_PROC_RATE_DST,
189 };
190
191 static struct ui_table flows_tbl;
192 static struct ui_table procs_tbl;
193
194 enum tab_entry {
195 TAB_FLOWS,
196 TAB_PROCS,
197 };
198
199 static const char *short_options = "vhTUsDIS46ut:nGb";
200 static const struct option long_options[] = {
201 {"ipv4", no_argument, NULL, '4'},
202 {"ipv6", no_argument, NULL, '6'},
203 {"tcp", no_argument, NULL, 'T'},
204 {"udp", no_argument, NULL, 'U'},
205 {"dccp", no_argument, NULL, 'D'},
206 {"icmp", no_argument, NULL, 'I'},
207 {"sctp", no_argument, NULL, 'S'},
208 {"no-dns", no_argument, NULL, 'n'},
209 {"no-geoip", no_argument, NULL, 'G'},
210 {"show-src", no_argument, NULL, 's'},
211 {"bits", no_argument, NULL, 'b'},
212 {"update", no_argument, NULL, 'u'},
213 {"interval", required_argument, NULL, 't'},
214 {"version", no_argument, NULL, 'v'},
215 {"help", no_argument, NULL, 'h'},
216 {NULL, 0, NULL, 0}
217 };
218
219 static const char *copyright = "Please report bugs to <netsniff-ng@googlegroups.com>\n"
220 "Copyright (C) 2011-2013 Daniel Borkmann <dborkma@tik.ee.ethz.ch>\n"
221 "Copyright (C) 2011-2012 Emmanuel Roullit <emmanuel.roullit@gmail.com>\n"
222 "Swiss federal institute of technology (ETH Zurich)\n"
223 "License: GNU GPL version 2.0\n"
224 "This is free software: you are free to change and redistribute it.\n"
225 "There is NO WARRANTY, to the extent permitted by law.";
226
227 static const char *const l4proto2str[IPPROTO_MAX] = {
228 [IPPROTO_TCP] = "tcp",
229 [IPPROTO_UDP] = "udp",
230 [IPPROTO_UDPLITE] = "udplite",
231 [IPPROTO_ICMP] = "icmp",
232 [IPPROTO_ICMPV6] = "icmpv6",
233 [IPPROTO_SCTP] = "sctp",
234 [IPPROTO_GRE] = "gre",
235 [IPPROTO_DCCP] = "dccp",
236 [IPPROTO_IGMP] = "igmp",
237 [IPPROTO_IPIP] = "ipip",
238 [IPPROTO_EGP] = "egp",
239 [IPPROTO_PUP] = "pup",
240 [IPPROTO_IDP] = "idp",
241 [IPPROTO_RSVP] = "rsvp",
242 [IPPROTO_IPV6] = "ip6tun",
243 [IPPROTO_ESP] = "esp",
244 [IPPROTO_AH] = "ah",
245 [IPPROTO_PIM] = "pim",
246 [IPPROTO_COMP] = "comp",
247 };
248
249 static const char *const tcp_state2str[TCP_CONNTRACK_MAX] = {
250 [TCP_CONNTRACK_NONE] = "NONE",
251 [TCP_CONNTRACK_SYN_SENT] = "SYN-SENT",
252 [TCP_CONNTRACK_SYN_RECV] = "SYN-RECV",
253 [TCP_CONNTRACK_ESTABLISHED] = "ESTABLISHED",
254 [TCP_CONNTRACK_FIN_WAIT] = "FIN-WAIT",
255 [TCP_CONNTRACK_CLOSE_WAIT] = "CLOSE-WAIT",
256 [TCP_CONNTRACK_LAST_ACK] = "LAST-ACK",
257 [TCP_CONNTRACK_TIME_WAIT] = "TIME-WAIT",
258 [TCP_CONNTRACK_CLOSE] = "CLOSE",
259 [TCP_CONNTRACK_SYN_SENT2] = "SYN-SENT2",
260 };
261
262 static const char *const dccp_state2str[DCCP_CONNTRACK_MAX] = {
263 [DCCP_CONNTRACK_NONE] = "NONE",
264 [DCCP_CONNTRACK_REQUEST] = "REQUEST",
265 [DCCP_CONNTRACK_RESPOND] = "RESPOND",
266 [DCCP_CONNTRACK_PARTOPEN] = "PARTOPEN",
267 [DCCP_CONNTRACK_OPEN] = "OPEN",
268 [DCCP_CONNTRACK_CLOSEREQ] = "CLOSE-REQ",
269 [DCCP_CONNTRACK_CLOSING] = "CLOSING",
270 [DCCP_CONNTRACK_TIMEWAIT] = "TIME-WAIT",
271 [DCCP_CONNTRACK_IGNORE] = "IGNORE",
272 [DCCP_CONNTRACK_INVALID] = "INVALID",
273 };
274
275 static const char *const sctp_state2str[SCTP_CONNTRACK_MAX] = {
276 [SCTP_CONNTRACK_NONE] = "NONE",
277 [SCTP_CONNTRACK_CLOSED] = "CLOSED",
278 [SCTP_CONNTRACK_COOKIE_WAIT] = "COOKIE-WAIT",
279 [SCTP_CONNTRACK_COOKIE_ECHOED] = "COOKIE-ECHO",
280 [SCTP_CONNTRACK_ESTABLISHED] = "ESTABLISHED",
281 [SCTP_CONNTRACK_SHUTDOWN_SENT] = "SHUTD-SENT",
282 [SCTP_CONNTRACK_SHUTDOWN_RECD] = "SHUTD-RCVD",
283 [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = "SHUTD-ACK",
284 };
285
286 static const struct nfct_filter_ipv4 filter_ipv4 = {
287 .addr = __constant_htonl(INADDR_LOOPBACK),
288 .mask = 0xffffffff,
289 };
290
291 static const struct nfct_filter_ipv6 filter_ipv6 = {
292 .addr = { 0x0, 0x0, 0x0, 0x1 },
293 .mask = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff },
294 };
295
296 static int64_t time_after_us(struct timeval *tv)
297 {
298 struct timeval now;
299
300 bug_on(gettimeofday(&now, NULL));
301
302 now.tv_sec -= tv->tv_sec;
303 now.tv_usec -= tv->tv_usec;
304
305 return now.tv_sec * USEC_PER_SEC + now.tv_usec;
306 }
307
308 static void signal_handler(int number)
309 {
310 switch (number) {
311 case SIGINT:
312 case SIGQUIT:
313 case SIGTERM:
314 sigint = 1;
315 break;
316 case SIGHUP:
317 default:
318 break;
319 }
320 }
321
322 static void flow_entry_from_ct(struct flow_entry *n, const struct nf_conntrack *ct);
323 static void flow_entry_get_extended(struct flow_entry *n);
324
325 static void help(void)
326 {
327 printf("flowtop %s, top-like netfilter TCP/UDP/SCTP/.. flow tracking\n",
328 VERSION_STRING);
329 puts("http://www.netsniff-ng.org\n\n"
330 "Usage: flowtop [options]\n"
331 "Options:\n"
332 " -4|--ipv4 Show only IPv4 flows (default)\n"
333 " -6|--ipv6 Show only IPv6 flows (default)\n"
334 " -T|--tcp Show only TCP flows (default)\n"
335 " -U|--udp Show only UDP flows\n"
336 " -D|--dccp Show only DCCP flows\n"
337 " -I|--icmp Show only ICMP/ICMPv6 flows\n"
338 " -S|--sctp Show only SCTP flows\n"
339 " -n|--no-dns Don't perform hostname lookup\n"
340 " -G|--no-geoip Don't perform GeoIP lookup\n"
341 " -s|--show-src Also show source, not only dest\n"
342 " -b|--bits Show rates in bits/s instead of bytes/s\n"
343 " -u|--update Update GeoIP databases\n"
344 " -t|--interval <time> Refresh time in seconds (default 1s)\n"
345 " -v|--version Print version and exit\n"
346 " -h|--help Print this help and exit\n\n"
347 "Examples:\n"
348 " flowtop\n"
349 " flowtop -46UTDISs\n\n"
350 "Note:\n"
351 " If netfilter is not running, you can activate it with e.g.:\n"
352 " iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n"
353 " iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n");
354 puts(copyright);
355 die();
356 }
357
358 static void version(void)
359 {
360 printf("flowtop %s, Git id: %s\n", VERSION_LONG, GITVERSION);
361 puts("top-like netfilter TCP/UDP/SCTP/.. flow tracking\n"
362 "http://www.netsniff-ng.org\n");
363 puts(copyright);
364 die();
365 }
366
367 static void flow_entry_update_time(struct flow_entry *n)
368 {
369 bug_on(gettimeofday(&n->last_update, NULL));
370 }
371
372 #define CALC_RATE(fld) do { \
373 n->rate_##fld = (((fld) > n->fld) ? (((fld) - n->fld) / sec) : 0); \
374 } while (0)
375
376 static void flow_entry_calc_rate(struct flow_entry *n, const struct nf_conntrack *ct)
377 {
378 uint64_t bytes_src = nfct_get_attr_u64(ct, ATTR_ORIG_COUNTER_BYTES);
379 uint64_t bytes_dst = nfct_get_attr_u64(ct, ATTR_REPL_COUNTER_BYTES);
380 uint64_t pkts_src = nfct_get_attr_u64(ct, ATTR_ORIG_COUNTER_PACKETS);
381 uint64_t pkts_dst = nfct_get_attr_u64(ct, ATTR_REPL_COUNTER_PACKETS);
382 double sec = (double)time_after_us(&n->last_update) / USEC_PER_SEC;
383
384 if (sec < 1)
385 return;
386
387 CALC_RATE(bytes_src);
388 CALC_RATE(bytes_dst);
389 CALC_RATE(pkts_src);
390 CALC_RATE(pkts_dst);
391 }
392
393 static inline struct flow_entry *flow_entry_xalloc(void)
394 {
395 return xzmalloc(sizeof(struct flow_entry));
396 }
397
398 static inline void flow_entry_xfree(struct flow_entry *n)
399 {
400 if (n->ct)
401 nfct_destroy(n->ct);
402
403 xfree(n);
404 }
405
406 static void flow_entry_xfree_rcu(struct rcu_head *head)
407 {
408 struct flow_entry *n = container_of(head, struct flow_entry, rcu);
409
410 flow_entry_xfree(n);
411 }
412
413 static inline void flow_list_init(struct flow_list *fl)
414 {
415 CDS_INIT_LIST_HEAD(&fl->head);
416 }
417
418 static inline bool nfct_is_dns(const struct nf_conntrack *ct)
419 {
420 uint16_t port_src = nfct_get_attr_u16(ct, ATTR_ORIG_PORT_SRC);
421 uint16_t port_dst = nfct_get_attr_u16(ct, ATTR_ORIG_PORT_DST);
422
423 return ntohs(port_src) == 53 || ntohs(port_dst) == 53;
424 }
425
426 static int flow_list_new_entry(struct flow_list *fl, struct nf_conntrack *ct)
427 {
428 struct flow_entry *n;
429
430 /* We don't want to analyze / display DNS itself, since we
431 * use it to resolve reverse dns.
432 */
433 if (nfct_is_dns(ct))
434 return NFCT_CB_CONTINUE;
435
436 n = flow_entry_xalloc();
437
438 n->ct = ct;
439
440 flow_entry_update_time(n);
441 flow_entry_from_ct(n, ct);
442 flow_entry_get_extended(n);
443
444 cds_list_add_rcu(&n->entry, &fl->head);
445
446 n->is_visible = true;
447
448 return NFCT_CB_STOLEN;
449 }
450
451 static struct flow_entry *flow_list_find_id(struct flow_list *fl, uint32_t id)
452 {
453 struct flow_entry *n;
454
455 cds_list_for_each_entry_rcu(n, &fl->head, entry) {
456 if (n->flow_id == id)
457 return n;
458 }
459
460 return NULL;
461 }
462
463 static int flow_list_del_entry(struct flow_list *fl, const struct nf_conntrack *ct)
464 {
465 struct flow_entry *n;
466
467 n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
468 if (n) {
469 if (n->proc) {
470 cds_list_del(&n->proc_head);
471 n->proc->flows_count--;
472 }
473
474 cds_list_del_rcu(&n->entry);
475 call_rcu(&n->rcu, flow_entry_xfree_rcu);
476 }
477
478 return NFCT_CB_CONTINUE;
479 }
480
481 static void flow_list_destroy(struct flow_list *fl)
482 {
483 struct flow_entry *n, *tmp;
484
485 cds_list_for_each_entry_safe(n, tmp, &fl->head, entry) {
486 cds_list_del_rcu(&n->entry);
487 call_rcu(&n->rcu, flow_entry_xfree_rcu);
488 }
489 }
490
491 static void proc_list_init(struct proc_list *proc_list)
492 {
493 CDS_INIT_LIST_HEAD(&proc_list->head);
494 }
495
496 static struct proc_entry *proc_list_new_entry(unsigned int pid)
497 {
498 struct proc_entry *proc;
499
500 cds_list_for_each_entry(proc, &proc_list.head, entry) {
501 if (proc->pid && proc->pid == pid)
502 return proc;
503 }
504
505 proc = xzmalloc(sizeof(*proc));
506
507 bug_on(gettimeofday(&proc->last_update, NULL));
508 CDS_INIT_LIST_HEAD(&proc->flows);
509 proc->pid = pid;
510
511 cds_list_add_tail(&proc->entry, &proc_list.head);
512
513 return proc;
514 }
515
516 static void proc_entry_xfree_rcu(struct rcu_head *head)
517 {
518 struct proc_entry *p = container_of(head, struct proc_entry, rcu);
519
520 xfree(p);
521 }
522
523 static void proc_list_destroy(struct proc_list *pl)
524 {
525 struct proc_entry *p, *tmp;
526
527 cds_list_for_each_entry_safe(p, tmp, &pl->head, entry) {
528 cds_list_del_rcu(&p->entry);
529 call_rcu(&p->rcu, proc_entry_xfree_rcu);
530 }
531 }
532
533 static void flow_entry_find_process(struct flow_entry *n)
534 {
535 struct proc_entry *p;
536 char cmdline[512];
537 pid_t pid;
538 int ret;
539
540 ret = proc_find_by_inode(n->inode, cmdline, sizeof(cmdline), &pid);
541 if (ret <= 0)
542 return;
543
544 p = proc_list_new_entry(pid);
545
546 if (snprintf(p->name, sizeof(p->name), "%s", basename(cmdline)) < 0)
547 p->name[0] = '\0';
548
549 p->pkts_src += n->pkts_src;
550 p->pkts_dst += n->pkts_dst;
551 p->bytes_src += n->bytes_src;
552 p->bytes_dst += n->bytes_dst;
553 p->flows_count++;
554
555 cds_list_add(&n->proc_head, &p->flows);
556 n->proc = p;
557 }
558
559 static int get_port_inode(uint16_t port, int proto, bool is_ip6)
560 {
561 int ret = -ENOENT;
562 char path[128], buff[1024];
563 FILE *proc;
564
565 memset(path, 0, sizeof(path));
566 snprintf(path, sizeof(path), "/proc/net/%s%s",
567 l4proto2str[proto], is_ip6 ? "6" : "");
568
569 proc = fopen(path, "r");
570 if (!proc)
571 return -EIO;
572
573 memset(buff, 0, sizeof(buff));
574
575 while (fgets(buff, sizeof(buff), proc) != NULL) {
576 int inode = 0;
577 unsigned int lport = 0;
578
579 buff[sizeof(buff) - 1] = 0;
580 if (sscanf(buff, "%*u: %*X:%X %*X:%*X %*X %*X:%*X %*X:%*X "
581 "%*X %*u %*u %u", &lport, &inode) == 2) {
582 if ((uint16_t) lport == port) {
583 ret = inode;
584 break;
585 }
586 }
587
588 memset(buff, 0, sizeof(buff));
589 }
590
591 fclose(proc);
592 return ret;
593 }
594
595 #define CP_NFCT(elem, attr, x) \
596 do { n->elem = nfct_get_attr_u##x(ct,(attr)); } while (0)
597 #define CP_NFCT_BUFF(elem, attr) do { \
598 const uint8_t *buff = nfct_get_attr(ct,(attr)); \
599 if (buff != NULL) \
600 memcpy(n->elem, buff, sizeof(n->elem)); \
601 } while (0)
602
603 static void flow_entry_from_ct(struct flow_entry *n, const struct nf_conntrack *ct)
604 {
605 uint64_t bytes_src = nfct_get_attr_u64(ct, ATTR_ORIG_COUNTER_BYTES);
606 uint64_t bytes_dst = nfct_get_attr_u64(ct, ATTR_REPL_COUNTER_BYTES);
607 uint64_t pkts_src = nfct_get_attr_u64(ct, ATTR_ORIG_COUNTER_PACKETS);
608 uint64_t pkts_dst = nfct_get_attr_u64(ct, ATTR_REPL_COUNTER_PACKETS);
609
610 /* Update stats diff to the related process entry */
611 if (n->proc) {
612 n->proc->pkts_src += pkts_src - n->pkts_src;
613 n->proc->pkts_dst += pkts_dst - n->pkts_dst;
614 n->proc->bytes_src += bytes_src - n->bytes_src;
615 n->proc->bytes_dst += bytes_dst - n->bytes_dst;
616 }
617
618 CP_NFCT(l3_proto, ATTR_ORIG_L3PROTO, 8);
619 CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
620
621 CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
622 CP_NFCT(ip4_dst_addr, ATTR_ORIG_IPV4_DST, 32);
623
624 CP_NFCT(port_src, ATTR_ORIG_PORT_SRC, 16);
625 CP_NFCT(port_dst, ATTR_ORIG_PORT_DST, 16);
626
627 CP_NFCT(status, ATTR_STATUS, 32);
628
629 CP_NFCT(tcp_state, ATTR_TCP_STATE, 8);
630 CP_NFCT(tcp_flags, ATTR_TCP_FLAGS_ORIG, 8);
631 CP_NFCT(sctp_state, ATTR_SCTP_STATE, 8);
632 CP_NFCT(dccp_state, ATTR_DCCP_STATE, 8);
633
634 CP_NFCT(pkts_src, ATTR_ORIG_COUNTER_PACKETS, 64);
635 CP_NFCT(bytes_src, ATTR_ORIG_COUNTER_BYTES, 64);
636
637 CP_NFCT(pkts_dst, ATTR_REPL_COUNTER_PACKETS, 64);
638 CP_NFCT(bytes_dst, ATTR_REPL_COUNTER_BYTES, 64);
639
640 CP_NFCT(timestamp_start, ATTR_TIMESTAMP_START, 64);
641 CP_NFCT(timestamp_stop, ATTR_TIMESTAMP_STOP, 64);
642
643 CP_NFCT(flow_id, ATTR_ID, 32);
644 CP_NFCT(use, ATTR_USE, 32);
645
646 CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
647 CP_NFCT_BUFF(ip6_dst_addr, ATTR_ORIG_IPV6_DST);
648
649 n->port_src = ntohs(n->port_src);
650 n->port_dst = ntohs(n->port_dst);
651
652 n->ip4_src_addr = ntohl(n->ip4_src_addr);
653 n->ip4_dst_addr = ntohl(n->ip4_dst_addr);
654 }
655
656 #define SELFLD(dir,src_member,dst_member) \
657 (((dir) == FLOW_DIR_SRC) ? n->src_member : n->dst_member)
658
659 static void flow_entry_get_sain4_obj(const struct flow_entry *n,
660 enum flow_direction dir,
661 struct sockaddr_in *sa)
662 {
663 memset(sa, 0, sizeof(*sa));
664 sa->sin_family = PF_INET;
665 sa->sin_addr.s_addr = htonl(SELFLD(dir, ip4_src_addr, ip4_dst_addr));
666 }
667
668 static void flow_entry_get_sain6_obj(const struct flow_entry *n,
669 enum flow_direction dir,
670 struct sockaddr_in6 *sa)
671 {
672 memset(sa, 0, sizeof(*sa));
673 sa->sin6_family = PF_INET6;
674
675 memcpy(&sa->sin6_addr, SELFLD(dir, ip6_src_addr, ip6_dst_addr),
676 sizeof(sa->sin6_addr));
677 }
678
679 static void
680 flow_entry_geo_city_lookup_generic(struct flow_entry *n,
681 enum flow_direction dir)
682 {
683 struct sockaddr_in sa4;
684 struct sockaddr_in6 sa6;
685 const char *city = NULL;
686
687 switch (n->l3_proto) {
688 default:
689 bug();
690
691 case AF_INET:
692 flow_entry_get_sain4_obj(n, dir, &sa4);
693 city = geoip4_city_name(&sa4);
694 break;
695
696 case AF_INET6:
697 flow_entry_get_sain6_obj(n, dir, &sa6);
698 city = geoip6_city_name(&sa6);
699 break;
700 }
701
702 build_bug_on(sizeof(n->city_src) != sizeof(n->city_dst));
703
704 if (city)
705 strlcpy(SELFLD(dir, city_src, city_dst), city,
706 sizeof(n->city_src));
707 else
708 SELFLD(dir, city_src, city_dst)[0] = '\0';
709 }
710
711 static void
712 flow_entry_geo_country_lookup_generic(struct flow_entry *n,
713 enum flow_direction dir)
714 {
715 struct sockaddr_in sa4;
716 struct sockaddr_in6 sa6;
717 const char *country = NULL;
718 const char *country_code = NULL;
719
720 switch (n->l3_proto) {
721 default:
722 bug();
723
724 case AF_INET:
725 flow_entry_get_sain4_obj(n, dir, &sa4);
726 country = geoip4_country_name(&sa4);
727 country_code = geoip4_country_code3_name(&sa4);
728 break;
729
730 case AF_INET6:
731 flow_entry_get_sain6_obj(n, dir, &sa6);
732 country = geoip6_country_name(&sa6);
733 country_code = geoip6_country_code3_name(&sa6);
734 break;
735 }
736
737 build_bug_on(sizeof(n->country_src) != sizeof(n->country_dst));
738
739 if (country)
740 strlcpy(SELFLD(dir, country_src, country_dst), country,
741 sizeof(n->country_src));
742 else
743 SELFLD(dir, country_src, country_dst)[0] = '\0';
744
745 build_bug_on(sizeof(n->country_code_src) != sizeof(n->country_code_dst));
746
747 if (country_code)
748 strlcpy(SELFLD(dir, country_code_src, country_code_dst),
749 country_code, sizeof(n->country_code_src));
750 else
751 SELFLD(dir, country_code_src, country_code_dst)[0] = '\0';
752 }
753
754 static void flow_entry_get_extended_geo(struct flow_entry *n,
755 enum flow_direction dir)
756 {
757 if (resolve_geoip) {
758 flow_entry_geo_city_lookup_generic(n, dir);
759 flow_entry_geo_country_lookup_generic(n, dir);
760 }
761 }
762
763 static void flow_entry_get_extended_revdns(struct flow_entry *n,
764 enum flow_direction dir)
765 {
766 size_t sa_len;
767 struct sockaddr_in sa4;
768 struct sockaddr_in6 sa6;
769 struct sockaddr *sa;
770 struct hostent *hent;
771
772 build_bug_on(sizeof(n->rev_dns_src) != sizeof(n->rev_dns_dst));
773
774 switch (n->l3_proto) {
775 default:
776 bug();
777
778 case AF_INET:
779 flow_entry_get_sain4_obj(n, dir, &sa4);
780
781 if (!resolve_dns) {
782 inet_ntop(AF_INET, &sa4.sin_addr,
783 SELFLD(dir, rev_dns_src, rev_dns_dst),
784 sizeof(n->rev_dns_src));
785 return;
786 }
787
788 sa = (struct sockaddr *) &sa4;
789 sa_len = sizeof(sa4);
790 hent = gethostbyaddr(&sa4.sin_addr, sizeof(sa4.sin_addr), AF_INET);
791 break;
792
793 case AF_INET6:
794 flow_entry_get_sain6_obj(n, dir, &sa6);
795
796 if (!resolve_dns) {
797 inet_ntop(AF_INET6, &sa6.sin6_addr,
798 SELFLD(dir, rev_dns_src, rev_dns_dst),
799 sizeof(n->rev_dns_src));
800 return;
801 }
802
803 sa = (struct sockaddr *) &sa6;
804 sa_len = sizeof(sa6);
805 hent = gethostbyaddr(&sa6.sin6_addr, sizeof(sa6.sin6_addr), AF_INET6);
806 break;
807 }
808
809 getnameinfo(sa, sa_len, SELFLD(dir, rev_dns_src, rev_dns_dst),
810 sizeof(n->rev_dns_src), NULL, 0, NI_NUMERICHOST);
811
812 if (hent)
813 strlcpy(SELFLD(dir, rev_dns_src, rev_dns_dst), hent->h_name,
814 sizeof(n->rev_dns_src));
815 }
816
817 static void flow_entry_get_extended(struct flow_entry *n)
818 {
819 if (n->flow_id == 0)
820 return;
821
822 flow_entry_get_extended_revdns(n, FLOW_DIR_SRC);
823 flow_entry_get_extended_geo(n, FLOW_DIR_SRC);
824
825 flow_entry_get_extended_revdns(n, FLOW_DIR_DST);
826 flow_entry_get_extended_geo(n, FLOW_DIR_DST);
827
828 /* Lookup application */
829 n->inode = get_port_inode(n->port_src, n->l4_proto,
830 n->l3_proto == AF_INET6);
831 if (n->inode > 0)
832 flow_entry_find_process(n);
833 }
834
835 static char *bandw2str(double bytes, char *buf, size_t len)
836 {
837 if (bytes <= 0) {
838 buf[0] = '\0';
839 return buf;
840 }
841
842 if (bytes > 1000000000.)
843 snprintf(buf, len, "%.1fGB", bytes / 1000000000.);
844 else if (bytes > 1000000.)
845 snprintf(buf, len, "%.1fMB", bytes / 1000000.);
846 else if (bytes > 1000.)
847 snprintf(buf, len, "%.1fkB", bytes / 1000.);
848 else
849 snprintf(buf, len, "%.0f", bytes);
850
851 return buf;
852 }
853
854 static char *rate2str(double rate, char *buf, size_t len)
855 {
856 const char * const unit_fmt[2][4] = {
857 { "%.1fGbit/s", "%.1fMbit/s", "%.1fkbit/s", "%.0fbit/s" },
858 { "%.1fGB/s", "%.1fMB/s", "%.1fkB/s", "%.0fB/s" }
859 };
860
861 if (rate <= 0) {
862 buf[0] = '\0';
863 return buf;
864 }
865
866 if (rate_type == RATE_BITS)
867 rate *= 8;
868
869 if (rate > 1000000000.)
870 snprintf(buf, len, unit_fmt[rate_type][0], rate / 1000000000.);
871 else if (rate > 1000000.)
872 snprintf(buf, len, unit_fmt[rate_type][1], rate / 1000000.);
873 else if (rate > 1000.)
874 snprintf(buf, len, unit_fmt[rate_type][2], rate / 1000.);
875 else
876 snprintf(buf, len, unit_fmt[rate_type][3], rate);
877
878 return buf;
879 }
880
881 static char *time2str(uint64_t tstamp, char *str, size_t len)
882 {
883 time_t now;
884 int v, s;
885
886 time(&now);
887
888 s = now - (tstamp ? (tstamp / NSEC_PER_SEC) : now);
889 if (s <= 0) {
890 str[0] = '\0';
891 return str;
892 }
893
894 v = s / (3600 * 24);
895 if (v > 0) {
896 slprintf(str, len, "%dd", v);
897 return str;
898 }
899
900 v = s / 3600;
901 if (v > 0) {
902 slprintf(str, len, "%dh", v);
903 return str;
904 }
905
906 v = s / 60;
907 if (v > 0) {
908 slprintf(str, len, "%dm", v);
909 return str;
910 }
911
912 slprintf(str, len, "%ds", s);
913 return str;
914 }
915
916
917 static const char *flow_state2str(const struct flow_entry *n)
918 {
919 switch (n->l4_proto) {
920 case IPPROTO_TCP:
921 return tcp_state2str[n->tcp_state];
922 case IPPROTO_SCTP:
923 return sctp_state2str[n->sctp_state];
924 case IPPROTO_DCCP:
925 return dccp_state2str[n->dccp_state];
926
927 case IPPROTO_UDP:
928 case IPPROTO_UDPLITE:
929 case IPPROTO_ICMP:
930 case IPPROTO_ICMPV6:
931 default:
932 return "";
933 }
934 }
935
936 static char *flow_port2str(const struct flow_entry *n, char *str, size_t len,
937 enum flow_direction dir)
938 {
939 const char *tmp = NULL;
940 uint16_t port = 0;
941
942 port = SELFLD(dir, port_src, port_dst);
943 tmp = NULL;
944
945 switch (n->l4_proto) {
946 case IPPROTO_TCP:
947 tmp = lookup_port_tcp(port);
948 break;
949 case IPPROTO_UDP:
950 case IPPROTO_UDPLITE:
951 tmp = lookup_port_udp(port);
952 break;
953 }
954
955 if (!tmp && port)
956 slprintf(str, len, "%d", port);
957 else
958 slprintf(str, len, "%s", tmp ? tmp : "");
959
960 return str;
961 }
962
963 static void print_flow_peer_info(const struct flow_entry *n, enum flow_direction dir)
964 {
965 int counters_color = COLOR(YELLOW, BLACK);
966 int src_color = COLOR(RED, BLACK);
967 int dst_color = COLOR(BLUE, BLACK);
968 int country_color = COLOR(GREEN, BLACK);
969 int addr_color = dst_color;
970 int port_color = A_BOLD;
971 char tmp[128];
972
973 if (show_src && dir == FLOW_DIR_SRC) {
974 country_color = src_color;
975 counters_color = src_color;
976 port_color |= src_color;
977 addr_color = src_color;
978 } else if (show_src && FLOW_DIR_DST) {
979 country_color = dst_color;
980 counters_color = dst_color;
981 port_color |= dst_color;
982 addr_color = dst_color;
983 }
984
985 ui_table_col_color_set(&flows_tbl, TBL_FLOW_ADDRESS, addr_color);
986 ui_table_col_color_set(&flows_tbl, TBL_FLOW_PORT, port_color);
987 ui_table_col_color_set(&flows_tbl, TBL_FLOW_GEO, country_color);
988 ui_table_col_color_set(&flows_tbl, TBL_FLOW_BYTES, counters_color);
989 ui_table_col_color_set(&flows_tbl, TBL_FLOW_RATE, counters_color);
990
991 /* Reverse DNS/IP */
992 ui_table_row_col_set(&flows_tbl, TBL_FLOW_ADDRESS,
993 SELFLD(dir, rev_dns_src, rev_dns_dst));
994
995 /* Application port */
996 ui_table_row_col_set(&flows_tbl, TBL_FLOW_PORT,
997 flow_port2str(n, tmp, sizeof(tmp), dir));
998
999 /* GEO */
1000 ui_table_row_col_set(&flows_tbl, TBL_FLOW_GEO,
1001 SELFLD(dir, country_code_src, country_code_dst));
1002
1003 /* Bytes */
1004 ui_table_row_col_set(&flows_tbl, TBL_FLOW_BYTES,
1005 bandw2str(SELFLD(dir, bytes_src, bytes_dst),
1006 tmp, sizeof(tmp) - 1));
1007
1008 /* Rate bytes */
1009 ui_table_row_col_set(&flows_tbl, TBL_FLOW_RATE,
1010 rate2str(SELFLD(dir, rate_bytes_src, rate_bytes_dst),
1011 tmp, sizeof(tmp) - 1));
1012 }
1013
1014 static void draw_flow_entry(const struct flow_entry *n)
1015 {
1016 char tmp[128];
1017
1018 ui_table_row_add(&flows_tbl);
1019
1020 /* Application */
1021 ui_table_row_col_set(&flows_tbl, TBL_FLOW_PROCESS,
1022 n->proc ? n->proc->name : "");
1023
1024 /* PID */
1025 slprintf(tmp, sizeof(tmp), "%.d", n->proc ? n->proc->pid : 0);
1026 ui_table_row_col_set(&flows_tbl, TBL_FLOW_PID, tmp);
1027
1028 /* L4 protocol */
1029 ui_table_row_col_set(&flows_tbl, TBL_FLOW_PROTO, l4proto2str[n->l4_proto]);
1030
1031 /* L4 protocol state */
1032 ui_table_row_col_set(&flows_tbl, TBL_FLOW_STATE, flow_state2str(n));
1033
1034 /* Time */
1035 time2str(n->timestamp_start, tmp, sizeof(tmp));
1036 ui_table_row_col_set(&flows_tbl, TBL_FLOW_TIME, tmp);
1037
1038 print_flow_peer_info(n, show_src ? FLOW_DIR_SRC : FLOW_DIR_DST);
1039
1040 ui_table_row_show(&flows_tbl);
1041
1042 if (show_src) {
1043 ui_table_row_add(&flows_tbl);
1044
1045 ui_table_row_col_set(&flows_tbl, TBL_FLOW_PROCESS, "");
1046 ui_table_row_col_set(&flows_tbl, TBL_FLOW_PID, "");
1047 ui_table_row_col_set(&flows_tbl, TBL_FLOW_PROTO, "");
1048 ui_table_row_col_set(&flows_tbl, TBL_FLOW_STATE, "");
1049 ui_table_row_col_set(&flows_tbl, TBL_FLOW_TIME, "");
1050
1051 print_flow_peer_info(n, FLOW_DIR_DST);
1052 ui_table_row_show(&flows_tbl);
1053 }
1054 }
1055
1056 static inline bool presenter_flow_wrong_state(struct flow_entry *n)
1057 {
1058 switch (n->l4_proto) {
1059 case IPPROTO_TCP:
1060 switch (n->tcp_state) {
1061 case TCP_CONNTRACK_SYN_SENT:
1062 case TCP_CONNTRACK_SYN_RECV:
1063 case TCP_CONNTRACK_ESTABLISHED:
1064 case TCP_CONNTRACK_FIN_WAIT:
1065 case TCP_CONNTRACK_CLOSE_WAIT:
1066 case TCP_CONNTRACK_LAST_ACK:
1067 case TCP_CONNTRACK_TIME_WAIT:
1068 case TCP_CONNTRACK_CLOSE:
1069 case TCP_CONNTRACK_SYN_SENT2:
1070 case TCP_CONNTRACK_NONE:
1071 return false;
1072 break;
1073 }
1074 break;
1075 case IPPROTO_SCTP:
1076 switch (n->sctp_state) {
1077 case SCTP_CONNTRACK_NONE:
1078 case SCTP_CONNTRACK_CLOSED:
1079 case SCTP_CONNTRACK_COOKIE_WAIT:
1080 case SCTP_CONNTRACK_COOKIE_ECHOED:
1081 case SCTP_CONNTRACK_ESTABLISHED:
1082 case SCTP_CONNTRACK_SHUTDOWN_SENT:
1083 case SCTP_CONNTRACK_SHUTDOWN_RECD:
1084 case SCTP_CONNTRACK_SHUTDOWN_ACK_SENT:
1085 return false;
1086 break;
1087 }
1088 break;
1089 case IPPROTO_DCCP:
1090 switch (n->dccp_state) {
1091 case DCCP_CONNTRACK_NONE:
1092 case DCCP_CONNTRACK_REQUEST:
1093 case DCCP_CONNTRACK_RESPOND:
1094 case DCCP_CONNTRACK_PARTOPEN:
1095 case DCCP_CONNTRACK_OPEN:
1096 case DCCP_CONNTRACK_CLOSEREQ:
1097 case DCCP_CONNTRACK_CLOSING:
1098 case DCCP_CONNTRACK_TIMEWAIT:
1099 case DCCP_CONNTRACK_IGNORE:
1100 case DCCP_CONNTRACK_INVALID:
1101 return false;
1102 break;
1103 }
1104 break;
1105 case IPPROTO_UDP:
1106 case IPPROTO_UDPLITE:
1107 case IPPROTO_ICMP:
1108 case IPPROTO_ICMPV6:
1109 return false;
1110 break;
1111 }
1112
1113 return true;
1114 }
1115
1116 static void draw_filter_status(char *title, int count, int skip_lines)
1117 {
1118 mvwprintw(screen, 1, 0, "%*s", COLS - 1, " ");
1119 mvwprintw(screen, 1, 2, "%s(%u) for ", title, count);
1120
1121 if (what & INCLUDE_IPV4)
1122 printw("IPv4,");
1123 if (what & INCLUDE_IPV6)
1124 printw("IPv6,");
1125 if (what & INCLUDE_TCP)
1126 printw("TCP,");
1127 if (what & INCLUDE_UDP)
1128 printw("UDP,");
1129 if (what & INCLUDE_SCTP)
1130 printw("SCTP,");
1131 if (what & INCLUDE_DCCP)
1132 printw("DCCP,");
1133 if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1134 printw("ICMP,");
1135 if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1136 printw("ICMP6,");
1137 if (show_active_only)
1138 printw("Active,");
1139
1140 printw(" [+%d]", skip_lines);
1141
1142 if (is_flow_collecting)
1143 printw(" [Collecting flows ...]");
1144
1145 }
1146
1147 static void draw_flows(WINDOW *screen, struct flow_list *fl,
1148 int skip_lines)
1149 {
1150 int row_width = show_src ? 2 : 1;
1151 unsigned int flows = 0;
1152 unsigned int line = 4;
1153 int skip = skip_lines;
1154 struct flow_entry *n;
1155
1156 rcu_read_lock();
1157
1158 if (cds_list_empty(&fl->head))
1159 mvwprintw(screen, line, 2, "(No sessions! "
1160 "Is netfilter running?)");
1161
1162 ui_table_clear(&flows_tbl);
1163 ui_table_header_print(&flows_tbl);
1164
1165 cds_list_for_each_entry_rcu(n, &fl->head, entry) {
1166 if (!n->is_visible)
1167 continue;
1168 if (presenter_flow_wrong_state(n))
1169 continue;
1170
1171 /* count only flows which might be showed */
1172 flows++;
1173
1174 if (line + row_width >= rows)
1175 continue;
1176 if (--skip >= 0)
1177 continue;
1178
1179 draw_flow_entry(n);
1180 line += row_width;
1181 }
1182
1183 rcu_read_unlock();
1184
1185 mvwprintw(screen, 1, 0, "%*s", COLS - 1, " ");
1186 mvwprintw(screen, 1, 2, "Kernel netfilter flows(%u) for ", flows);
1187
1188 draw_filter_status("Kernel netfilter flows", flows, skip_lines);
1189 }
1190
1191 static void draw_proc_entry(struct proc_entry *p)
1192 {
1193 struct ui_table *tbl = &procs_tbl;;
1194 char tmp[128];
1195
1196 ui_table_row_add(tbl);
1197
1198 /* Application */
1199 ui_table_row_col_set(tbl, TBL_PROC_NAME, p->name);
1200
1201 /* PID */
1202 slprintf(tmp, sizeof(tmp), "%.d", p->pid);
1203 ui_table_row_col_set(tbl, TBL_PROC_PID, tmp);
1204
1205 /* Flows */
1206 slprintf(tmp, sizeof(tmp), "%.d", p->flows_count);
1207 ui_table_row_col_set(tbl, TBL_PROC_FLOWS, tmp);
1208
1209 /* Bytes Src */
1210 bandw2str(p->bytes_src, tmp, sizeof(tmp) - 1);
1211 ui_table_row_col_set(tbl, TBL_PROC_BYTES_SRC, tmp);
1212
1213 /* Rate Src */
1214 rate2str(p->rate_bytes_src, tmp, sizeof(tmp) - 1);
1215 ui_table_row_col_set(tbl, TBL_PROC_RATE_SRC, tmp);
1216
1217 /* Bytes Dest */
1218 bandw2str(p->bytes_dst, tmp, sizeof(tmp) - 1);
1219 ui_table_row_col_set(tbl, TBL_PROC_BYTES_DST, tmp);
1220
1221 /* Rate Dest */
1222 rate2str(p->rate_bytes_dst, tmp, sizeof(tmp) - 1);
1223 ui_table_row_col_set(tbl, TBL_PROC_RATE_DST, tmp);
1224
1225 ui_table_row_show(tbl);
1226 }
1227
1228 static void draw_procs(WINDOW *screen, struct flow_list *fl,
1229 int skip_lines)
1230 {
1231 struct proc_entry *proc, *tmp;
1232 unsigned int line = 4;
1233 int skip = skip_lines;
1234 int procs = 0;
1235
1236 rcu_read_lock();
1237
1238 ui_table_clear(&procs_tbl);
1239 ui_table_header_print(&procs_tbl);
1240
1241 cds_list_for_each_entry_safe(proc, tmp, &proc_list.head, entry) {
1242 if (line + 1 >= rows)
1243 continue;
1244 if (--skip >= 0)
1245 continue;
1246
1247 draw_proc_entry(proc);
1248 procs++;
1249 line++;
1250 }
1251
1252 rcu_read_unlock();
1253
1254 draw_filter_status("Processes", procs, skip_lines);
1255 }
1256
1257 static void draw_help(void)
1258 {
1259 int col = 0;
1260 int row = 1;
1261 int i;
1262
1263 mvaddch(row, col, ACS_ULCORNER);
1264 mvaddch(rows - row - 1, col, ACS_LLCORNER);
1265
1266 mvaddch(row, cols - 1, ACS_URCORNER);
1267 mvaddch(rows - row - 1, cols - 1, ACS_LRCORNER);
1268
1269 for (i = 1; i < rows - row - 2; i++) {
1270 mvaddch(row + i, 0, ACS_VLINE);
1271 mvaddch(row + i, cols - 1, ACS_VLINE);
1272 }
1273 for (i = 1; i < cols - col - 1; i++) {
1274 mvaddch(row, col + i, ACS_HLINE);
1275 mvaddch(rows - row - 1, col + i, ACS_HLINE);
1276 }
1277
1278 attron(A_BOLD);
1279 mvaddnstr(row, cols / 2 - 2, "| Help |", -1);
1280
1281 attron(A_UNDERLINE);
1282 mvaddnstr(row + 2, col + 2, "Navigation", -1);
1283 attroff(A_BOLD | A_UNDERLINE);
1284
1285 mvaddnstr(row + 4, col + 3, "TAB Go to next tab panel", -1);
1286 mvaddnstr(row + 5, col + 3, "Up, u, k Move up", -1);
1287 mvaddnstr(row + 6, col + 3, "Down, d, j Move down", -1);
1288 mvaddnstr(row + 7, col + 3, "Left,l Scroll left", -1);
1289 mvaddnstr(row + 8, col + 3, "Right,h Scroll right", -1);
1290 mvaddnstr(row + 9, col + 3, "? Toggle help window", -1);
1291 mvaddnstr(row + 10, col + 3, "q, Ctrl+C Quit", -1);
1292
1293 attron(A_BOLD | A_UNDERLINE);
1294 mvaddnstr(row + 12, col + 2, "Display Settings", -1);
1295 attroff(A_BOLD | A_UNDERLINE);
1296
1297 mvaddnstr(row + 14, col + 3, "b Toggle rate units (bits/bytes)", -1);
1298 mvaddnstr(row + 15, col + 3, "a Toggle display of active flows (rate > 0) only", -1);
1299 mvaddnstr(row + 16, col + 3, "s Toggle show source peer info", -1);
1300
1301 mvaddnstr(row + 18, col + 3, "T Toggle display TCP flows", -1);
1302 mvaddnstr(row + 19, col + 3, "U Toggle display UDP flows", -1);
1303 mvaddnstr(row + 20, col + 3, "D Toggle display DCCP flows", -1);
1304 mvaddnstr(row + 21, col + 3, "I Toggle display ICMP flows", -1);
1305 mvaddnstr(row + 22, col + 3, "S Toggle display SCTP flows", -1);
1306 }
1307
1308 static void draw_header(WINDOW *screen)
1309 {
1310 int i;
1311
1312 attron(A_STANDOUT);
1313
1314 for (i = 0; i < cols; i++)
1315 mvaddch(0, i, ' ');
1316
1317 mvwprintw(screen, 0, 2, "flowtop %s", VERSION_LONG);
1318 attroff(A_STANDOUT);
1319 }
1320
1321 static void draw_footer(void)
1322 {
1323 int i;
1324
1325 attron(A_STANDOUT);
1326
1327 for (i = 0; i < cols; i++)
1328 mvaddch(rows - 1, i, ' ');
1329
1330 mvaddnstr(rows - 1, 1, "Press '?' for help", -1);
1331 addch(ACS_VLINE);
1332 attroff(A_STANDOUT);
1333 }
1334
1335 static void show_option_toggle(int opt)
1336 {
1337 switch (opt) {
1338 case 'T':
1339 TOGGLE_FLAG(what, INCLUDE_TCP);
1340 break;
1341 case 'U':
1342 TOGGLE_FLAG(what, INCLUDE_UDP);
1343 break;
1344 case 'D':
1345 TOGGLE_FLAG(what, INCLUDE_DCCP);
1346 break;
1347 case 'I':
1348 TOGGLE_FLAG(what, INCLUDE_ICMP);
1349 break;
1350 case 'S':
1351 TOGGLE_FLAG(what, INCLUDE_SCTP);
1352 break;
1353 }
1354 }
1355
1356 static void flows_table_init(struct ui_table *tbl)
1357 {
1358 ui_table_init(tbl);
1359
1360 ui_table_pos_set(tbl, 3, 0);
1361 ui_table_height_set(tbl, LINES - 3);
1362
1363 ui_table_col_add(tbl, TBL_FLOW_PROCESS, "PROCESS", 13);
1364 ui_table_col_add(tbl, TBL_FLOW_PID, "PID", 7);
1365 ui_table_col_add(tbl, TBL_FLOW_PROTO, "PROTO", 6);
1366 ui_table_col_add(tbl, TBL_FLOW_STATE, "STATE", 11);
1367 ui_table_col_add(tbl, TBL_FLOW_TIME, "TIME", 4);
1368 ui_table_col_add(tbl, TBL_FLOW_ADDRESS, "ADDRESS", 50);
1369 ui_table_col_add(tbl, TBL_FLOW_PORT, "PORT", 8);
1370 ui_table_col_add(tbl, TBL_FLOW_GEO, "GEO", 3);
1371 ui_table_col_add(tbl, TBL_FLOW_BYTES, "BYTES", 10);
1372 ui_table_col_add(tbl, TBL_FLOW_RATE, "RATE", 10);
1373
1374 ui_table_col_align_set(tbl, TBL_FLOW_TIME, UI_ALIGN_RIGHT);
1375 ui_table_col_align_set(tbl, TBL_FLOW_BYTES, UI_ALIGN_RIGHT);
1376 ui_table_col_align_set(tbl, TBL_FLOW_RATE, UI_ALIGN_RIGHT);
1377
1378 ui_table_col_color_set(tbl, TBL_FLOW_PROCESS, COLOR(YELLOW, BLACK));
1379 ui_table_col_color_set(tbl, TBL_FLOW_PID, A_BOLD);
1380 ui_table_col_color_set(tbl, TBL_FLOW_STATE, COLOR(YELLOW, BLACK));
1381
1382 ui_table_header_color_set(&flows_tbl, COLOR(BLACK, GREEN));
1383 }
1384
1385 static void procs_table_init(struct ui_table *tbl)
1386 {
1387 ui_table_init(tbl);
1388
1389 ui_table_pos_set(tbl, 3, 0);
1390 ui_table_height_set(tbl, LINES - 3);
1391
1392 ui_table_col_add(tbl, TBL_PROC_NAME, "NAME", 13);
1393 ui_table_col_add(tbl, TBL_PROC_PID, "PID", 7);
1394 ui_table_col_add(tbl, TBL_PROC_FLOWS, "FLOWS", 7);
1395 ui_table_col_add(tbl, TBL_PROC_BYTES_SRC, "BYTES_SRC", 10);
1396 ui_table_col_add(tbl, TBL_PROC_BYTES_DST, "BYTES_DST", 10);
1397 ui_table_col_add(tbl, TBL_PROC_RATE_SRC, "RATE_SRC", 14);
1398 ui_table_col_add(tbl, TBL_PROC_RATE_DST, "RATE_DST", 14);
1399
1400 ui_table_col_align_set(tbl, TBL_PROC_BYTES_SRC, UI_ALIGN_RIGHT);
1401 ui_table_col_align_set(tbl, TBL_PROC_RATE_SRC, UI_ALIGN_RIGHT);
1402 ui_table_col_align_set(tbl, TBL_PROC_BYTES_DST, UI_ALIGN_RIGHT);
1403 ui_table_col_align_set(tbl, TBL_PROC_RATE_DST, UI_ALIGN_RIGHT);
1404
1405 ui_table_col_color_set(tbl, TBL_PROC_NAME, COLOR(YELLOW, BLACK));
1406 ui_table_col_color_set(tbl, TBL_PROC_PID, A_BOLD);
1407 ui_table_col_color_set(tbl, TBL_PROC_FLOWS, COLOR(YELLOW, BLACK));
1408 ui_table_col_color_set(tbl, TBL_PROC_BYTES_SRC, COLOR(RED, BLACK));
1409 ui_table_col_color_set(tbl, TBL_PROC_RATE_SRC, COLOR(RED, BLACK));
1410 ui_table_col_color_set(tbl, TBL_PROC_BYTES_DST, COLOR(BLUE, BLACK));
1411 ui_table_col_color_set(tbl, TBL_PROC_RATE_DST, COLOR(BLUE, BLACK));
1412
1413 ui_table_header_color_set(tbl, COLOR(BLACK, GREEN));
1414 }
1415
1416 static void tab_main_on_open(struct ui_tab *tab, enum ui_tab_event_t evt, uint32_t id)
1417 {
1418 if (evt != UI_TAB_EVT_OPEN)
1419 return;
1420
1421 if (id == TAB_FLOWS)
1422 draw_flows(screen, &flow_list, skip_lines);
1423 else if (id == TAB_PROCS)
1424 draw_procs(screen, &flow_list, skip_lines);
1425 }
1426
1427 static void presenter(void)
1428 {
1429 bool show_help = false;
1430 struct ui_tab *tab_main;
1431
1432 lookup_init(LT_PORTS_TCP);
1433 lookup_init(LT_PORTS_UDP);
1434
1435 screen = screen_init(false);
1436 wclear(screen);
1437 halfdelay(1);
1438
1439 start_color();
1440 INIT_COLOR(RED, BLACK);
1441 INIT_COLOR(BLUE, BLACK);
1442 INIT_COLOR(YELLOW, BLACK);
1443 INIT_COLOR(GREEN, BLACK);
1444 INIT_COLOR(BLACK, GREEN);
1445
1446 flows_table_init(&flows_tbl);
1447 procs_table_init(&procs_tbl);
1448
1449 tab_main = ui_tab_create();
1450 ui_tab_event_cb_set(tab_main, tab_main_on_open);
1451 ui_tab_pos_set(tab_main, 2, 0);
1452 ui_tab_active_color_set(tab_main, COLOR(BLACK, GREEN));
1453 ui_tab_entry_add(tab_main, TAB_FLOWS, "Flows");
1454 ui_tab_entry_add(tab_main, TAB_PROCS, "Process");
1455
1456 rcu_register_thread();
1457 while (!sigint) {
1458 int ch;
1459
1460 curs_set(0);
1461 getmaxyx(screen, rows, cols);
1462
1463 ch = getch();
1464 switch (ch) {
1465 case 'q':
1466 sigint = 1;
1467 break;
1468 case KEY_UP:
1469 case 'u':
1470 case 'k':
1471 skip_lines--;
1472 if (skip_lines < 0)
1473 skip_lines = 0;
1474 break;
1475 case KEY_DOWN:
1476 case 'd':
1477 case 'j':
1478 skip_lines++;
1479 if (skip_lines > SCROLL_MAX)
1480 skip_lines = SCROLL_MAX;
1481 break;
1482 case KEY_LEFT:
1483 case 'h':
1484 ui_table_event_send(&flows_tbl, UI_EVT_SCROLL_LEFT);
1485 break;
1486 case KEY_RIGHT:
1487 case 'l':
1488 ui_table_event_send(&flows_tbl, UI_EVT_SCROLL_RIGHT);
1489 break;
1490 case 'b':
1491 if (rate_type == RATE_BYTES)
1492 rate_type = RATE_BITS;
1493 else
1494 rate_type = RATE_BYTES;
1495 break;
1496 case 'a':
1497 show_active_only = !show_active_only;
1498 break;
1499 case 's':
1500 show_src = !show_src;
1501 break;
1502 case '?':
1503 show_help = !show_help;
1504 wclear(screen);
1505 clear();
1506 break;
1507 case 'T':
1508 case 'U':
1509 case 'D':
1510 case 'I':
1511 case 'S':
1512 show_option_toggle(ch);
1513 do_reload_flows = true;
1514 break;
1515 case '\t':
1516 ui_tab_event_send(tab_main, UI_EVT_SELECT_NEXT);
1517 break;
1518 default:
1519 fflush(stdin);
1520 break;
1521 }
1522
1523 draw_header(screen);
1524
1525 if (show_help)
1526 draw_help();
1527 else
1528 ui_tab_show(tab_main);
1529
1530 draw_footer();
1531 }
1532 rcu_unregister_thread();
1533
1534 ui_table_uninit(&flows_tbl);
1535 ui_table_uninit(&procs_tbl);
1536 ui_tab_destroy(tab_main);
1537
1538 screen_end();
1539 lookup_cleanup(LT_PORTS_UDP);
1540 lookup_cleanup(LT_PORTS_TCP);
1541 }
1542
1543 static void restore_sysctl(void *obj)
1544 {
1545 struct sysctl_params_ctx *sysctl_ctx = obj;
1546
1547 if (sysctl_ctx->nfct_acct == 0)
1548 sysctl_set_int("net/netfilter/nf_conntrack_acct",
1549 sysctl_ctx->nfct_acct);
1550
1551 if (sysctl_ctx->nfct_tstamp == 0)
1552 sysctl_set_int("net/netfilter/nf_conntrack_timestamp",
1553 sysctl_ctx->nfct_tstamp);
1554 }
1555
1556 static void on_panic_handler(void *arg)
1557 {
1558 restore_sysctl(arg);
1559 screen_end();
1560 }
1561
1562 static void conntrack_acct_enable(void)
1563 {
1564 /* We can still work w/o traffic accounting so just warn about error */
1565 if (sysctl_get_int("net/netfilter/nf_conntrack_acct", &sysctl.nfct_acct)) {
1566 fprintf(stderr, "Can't read net/netfilter/nf_conntrack_acct: %s\n",
1567 strerror(errno));
1568 return;
1569 }
1570
1571 if (sysctl.nfct_acct == 1)
1572 return;
1573
1574 if (sysctl_set_int("net/netfilter/nf_conntrack_acct", 1)) {
1575 fprintf(stderr, "Can't write net/netfilter/nf_conntrack_acct: %s\n",
1576 strerror(errno));
1577 }
1578 }
1579
1580 static void conntrack_tstamp_enable(void)
1581 {
1582 if (sysctl_get_int("net/netfilter/nf_conntrack_timestamp", &sysctl.nfct_tstamp)) {
1583 fprintf(stderr, "Can't read net/netfilter/nf_conntrack_timestamp: %s\n",
1584 strerror(errno));
1585 return;
1586 }
1587
1588 if (sysctl.nfct_tstamp == 1)
1589 return;
1590
1591 if (sysctl_set_int("net/netfilter/nf_conntrack_timestamp", 1)) {
1592 fprintf(stderr, "Can't write net/netfilter/nf_conntrack_timestamp: %s\n",
1593 strerror(errno));
1594 }
1595 }
1596
1597 static void flow_entry_filter(struct flow_entry *n)
1598 {
1599 if (show_active_only && !n->rate_bytes_src && !n->rate_bytes_dst)
1600 n->is_visible = false;
1601 else
1602 n->is_visible = true;
1603 }
1604
1605 static int flow_list_update_entry(struct flow_list *fl, struct nf_conntrack *ct)
1606 {
1607 struct flow_entry *n;
1608
1609 n = flow_list_find_id(fl, nfct_get_attr_u32(ct, ATTR_ID));
1610 if (!n)
1611 return NFCT_CB_CONTINUE;
1612
1613 flow_entry_calc_rate(n, ct);
1614 flow_entry_update_time(n);
1615 flow_entry_from_ct(n, ct);
1616 flow_entry_filter(n);
1617
1618 return NFCT_CB_CONTINUE;
1619 }
1620
1621 static int flow_event_cb(enum nf_conntrack_msg_type type,
1622 struct nf_conntrack *ct, void *data __maybe_unused)
1623 {
1624 if (sigint)
1625 return NFCT_CB_STOP;
1626
1627 switch (type) {
1628 case NFCT_T_NEW:
1629 return flow_list_new_entry(&flow_list, ct);
1630 case NFCT_T_UPDATE:
1631 return flow_list_update_entry(&flow_list, ct);
1632 case NFCT_T_DESTROY:
1633 return flow_list_del_entry(&flow_list, ct);
1634 default:
1635 return NFCT_CB_CONTINUE;
1636 }
1637 }
1638
1639 static void collector_refresh_procs(void)
1640 {
1641 struct proc_entry *p, *tmp;
1642
1643 cds_list_for_each_entry_safe(p, tmp, &proc_list.head, entry) {
1644 double sec = (double)time_after_us(&p->last_update) / USEC_PER_SEC;
1645 struct flow_entry *n;
1646
1647 if (sec < 1)
1648 continue;
1649
1650 bug_on(gettimeofday(&p->last_update, NULL));
1651
1652 if (!p->flows_count && !proc_exists(p->pid)) {
1653 cds_list_del_rcu(&p->entry);
1654 call_rcu(&p->rcu, proc_entry_xfree_rcu);
1655 continue;
1656 }
1657
1658 p->rate_bytes_src = 0;
1659 p->rate_bytes_dst = 0;
1660 p->rate_pkts_src = 0;
1661 p->rate_pkts_dst = 0;
1662
1663 cds_list_for_each_entry_rcu(n, &p->flows, proc_head) {
1664 p->rate_bytes_src += n->rate_bytes_src;
1665 p->rate_bytes_dst += n->rate_bytes_dst;
1666 p->rate_pkts_src += n->rate_pkts_src;
1667 p->rate_pkts_dst += n->rate_pkts_dst;
1668 }
1669 }
1670 }
1671
1672 static void collector_refresh_flows(struct nfct_handle *handle)
1673 {
1674 struct flow_entry *n;
1675
1676 cds_list_for_each_entry_rcu(n, &flow_list.head, entry) {
1677 nfct_query(handle, NFCT_Q_GET, n->ct);
1678 }
1679 }
1680
1681 static void collector_create_filter(struct nfct_handle *nfct)
1682 {
1683 struct nfct_filter *filter;
1684 int ret;
1685
1686 filter = nfct_filter_create();
1687 if (!filter)
1688 panic("Cannot create a nfct filter: %s\n", strerror(errno));
1689
1690 if (what & INCLUDE_UDP) {
1691 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDP);
1692 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_UDPLITE);
1693 }
1694 if (what & INCLUDE_TCP)
1695 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_TCP);
1696 if (what & INCLUDE_DCCP)
1697 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_DCCP);
1698 if (what & INCLUDE_SCTP)
1699 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_SCTP);
1700 if (what & INCLUDE_ICMP && what & INCLUDE_IPV4)
1701 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMP);
1702 if (what & INCLUDE_ICMP && what & INCLUDE_IPV6)
1703 nfct_filter_add_attr_u32(filter, NFCT_FILTER_L4PROTO, IPPROTO_ICMPV6);
1704 if (what & INCLUDE_IPV4) {
1705 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV4, NFCT_FILTER_LOGIC_NEGATIVE);
1706 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV4, &filter_ipv4);
1707 }
1708 if (what & INCLUDE_IPV6) {
1709 nfct_filter_set_logic(filter, NFCT_FILTER_SRC_IPV6, NFCT_FILTER_LOGIC_NEGATIVE);
1710 nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
1711 }
1712
1713 ret = nfct_filter_attach(nfct_fd(nfct), filter);
1714 if (ret < 0)
1715 panic("Cannot attach filter to handle: %s\n", strerror(errno));
1716
1717 nfct_filter_destroy(filter);
1718 }
1719
1720 /* This hand-crafted filter looks ugly but it allows to do not
1721 * flush nfct connections & filter them by user specified filter.
1722 * May be it is better to replace this one by nfct_cmp. */
1723 static int flow_dump_cb(enum nf_conntrack_msg_type type __maybe_unused,
1724 struct nf_conntrack *ct, void *data __maybe_unused)
1725 {
1726 struct flow_entry fl;
1727 struct flow_entry *n = &fl;
1728
1729 if (sigint)
1730 return NFCT_CB_STOP;
1731
1732 if (!(what & ~(INCLUDE_IPV4 | INCLUDE_IPV6)))
1733 goto check_addr;
1734
1735 CP_NFCT(l4_proto, ATTR_ORIG_L4PROTO, 8);
1736
1737 if (what & INCLUDE_UDP) {
1738 if (n->l4_proto == IPPROTO_UDP)
1739 goto check_addr;
1740
1741 if (n->l4_proto == IPPROTO_UDPLITE)
1742 goto check_addr;
1743
1744 }
1745 if ((what & INCLUDE_TCP) && n->l4_proto == IPPROTO_TCP)
1746 goto check_addr;
1747
1748 if ((what & INCLUDE_DCCP) && n->l4_proto == IPPROTO_DCCP)
1749 goto check_addr;
1750
1751 if ((what & INCLUDE_SCTP) && n->l4_proto == IPPROTO_SCTP)
1752 goto check_addr;
1753
1754 if ((what & INCLUDE_ICMP) && (what & INCLUDE_IPV4) &&
1755 n->l4_proto == IPPROTO_ICMP) {
1756 goto check_addr;
1757 }
1758
1759 if ((what & INCLUDE_ICMP) && (what & INCLUDE_IPV6) &&
1760 n->l4_proto == IPPROTO_ICMPV6) {
1761 goto check_addr;
1762 }
1763
1764 goto skip_flow;
1765
1766 check_addr:
1767 /* filter loopback addresses */
1768 if (what & INCLUDE_IPV4) {
1769 CP_NFCT(ip4_src_addr, ATTR_ORIG_IPV4_SRC, 32);
1770
1771 if (n->ip4_src_addr == filter_ipv4.addr)
1772 goto skip_flow;
1773 }
1774 if (what & INCLUDE_IPV6) {
1775 CP_NFCT_BUFF(ip6_src_addr, ATTR_ORIG_IPV6_SRC);
1776
1777 if (n->ip6_src_addr[0] == 0x0 &&
1778 n->ip6_src_addr[1] == 0x0 &&
1779 n->ip6_src_addr[2] == 0x0 &&
1780 n->ip6_src_addr[3] == 0x1)
1781 goto skip_flow;
1782 }
1783
1784 return flow_list_new_entry(&flow_list, ct);
1785
1786 skip_flow:
1787 return NFCT_CB_CONTINUE;
1788 }
1789
1790 static void collector_dump_flows(void)
1791 {
1792 struct nfct_handle *nfct = nfct_open(CONNTRACK, 0);
1793
1794 if (!nfct)
1795 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1796
1797 nfct_callback_register(nfct, NFCT_T_ALL, flow_dump_cb, NULL);
1798
1799 is_flow_collecting = true;
1800 if (what & INCLUDE_IPV4) {
1801 int family = AF_INET;
1802 nfct_query(nfct, NFCT_Q_DUMP, &family);
1803 }
1804 if (what & INCLUDE_IPV6) {
1805 int family = AF_INET6;
1806 nfct_query(nfct, NFCT_Q_DUMP, &family);
1807 }
1808 is_flow_collecting = false;
1809
1810 nfct_close(nfct);
1811 }
1812
1813 static void *collector(void *null __maybe_unused)
1814 {
1815 struct nfct_handle *ct_event;
1816 struct pollfd poll_fd[1];
1817
1818 proc_list_init(&proc_list);
1819 flow_list_init(&flow_list);
1820
1821 ct_event = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW |
1822 NF_NETLINK_CONNTRACK_UPDATE |
1823 NF_NETLINK_CONNTRACK_DESTROY);
1824 if (!ct_event)
1825 panic("Cannot create a nfct handle: %s\n", strerror(errno));
1826
1827 collector_create_filter(ct_event);
1828
1829 nfct_callback_register(ct_event, NFCT_T_ALL, flow_event_cb, NULL);
1830
1831 poll_fd[0].fd = nfct_fd(ct_event);
1832 poll_fd[0].events = POLLIN;
1833
1834 if (fcntl(nfct_fd(ct_event), F_SETFL, O_NONBLOCK) == -1)
1835 panic("Cannot set non-blocking socket: fcntl(): %s\n",
1836 strerror(errno));
1837
1838 rcu_register_thread();
1839
1840 collector_dump_flows();
1841
1842 while (!sigint) {
1843 int status;
1844
1845 if (!do_reload_flows) {
1846 usleep(USEC_PER_SEC * interval);
1847 } else {
1848 do_reload_flows = false;
1849
1850 flow_list_destroy(&flow_list);
1851
1852 collector_create_filter(ct_event);
1853 collector_dump_flows();
1854 }
1855
1856 collector_refresh_procs();
1857 collector_refresh_flows(ct_event);
1858
1859 status = poll(poll_fd, 1, 0);
1860 if (status < 0) {
1861 if (errno == EAGAIN || errno == EINTR)
1862 continue;
1863
1864 panic("Error while polling: %s\n", strerror(errno));
1865 } else if (status != 0) {
1866 if (poll_fd[0].revents & POLLIN)
1867 nfct_catch(ct_event);
1868 }
1869 }
1870
1871 flow_list_destroy(&flow_list);
1872 proc_list_destroy(&proc_list);
1873
1874 rcu_unregister_thread();
1875
1876 nfct_close(ct_event);
1877
1878 pthread_exit(NULL);
1879 }
1880
1881 int main(int argc, char **argv)
1882 {
1883 pthread_t tid;
1884 int ret, c, what_cmd = 0;
1885
1886 setfsuid(getuid());
1887 setfsgid(getgid());
1888
1889 while ((c = getopt_long(argc, argv, short_options, long_options,
1890 NULL)) != EOF) {
1891 switch (c) {
1892 case '4':
1893 what_cmd |= INCLUDE_IPV4;
1894 break;
1895 case '6':
1896 what_cmd |= INCLUDE_IPV6;
1897 break;
1898 case 'T':
1899 what_cmd |= INCLUDE_TCP;
1900 break;
1901 case 'U':
1902 what_cmd |= INCLUDE_UDP;
1903 break;
1904 case 'D':
1905 what_cmd |= INCLUDE_DCCP;
1906 break;
1907 case 'I':
1908 what_cmd |= INCLUDE_ICMP;
1909 break;
1910 case 'S':
1911 what_cmd |= INCLUDE_SCTP;
1912 break;
1913 case 's':
1914 show_src = true;
1915 break;
1916 case 'b':
1917 rate_type = RATE_BITS;
1918 break;
1919 case 'u':
1920 update_geoip();
1921 die();
1922 break;
1923 case 't':
1924 interval = strtoul(optarg, NULL, 10);
1925 break;
1926 case 'n':
1927 resolve_dns = false;
1928 break;
1929 case 'G':
1930 resolve_geoip = false;
1931 break;
1932 case 'h':
1933 help();
1934 break;
1935 case 'v':
1936 version();
1937 break;
1938 default:
1939 break;
1940 }
1941 }
1942
1943 if (what_cmd > 0) {
1944 what = what_cmd;
1945
1946 if (!(what & (INCLUDE_IPV4 | INCLUDE_IPV6)))
1947 what |= INCLUDE_IPV4 | INCLUDE_IPV6;
1948 }
1949
1950 rcu_init();
1951
1952 register_signal(SIGINT, signal_handler);
1953 register_signal(SIGQUIT, signal_handler);
1954 register_signal(SIGTERM, signal_handler);
1955 register_signal(SIGHUP, signal_handler);
1956
1957 panic_handler_add(on_panic_handler, &sysctl);
1958
1959 conntrack_acct_enable();
1960 conntrack_tstamp_enable();
1961
1962 if (resolve_geoip)
1963 init_geoip(1);
1964
1965 ret = pthread_create(&tid, NULL, collector, NULL);
1966 if (ret < 0)
1967 panic("Cannot create phthread!\n");
1968
1969 presenter();
1970
1971 if (resolve_geoip)
1972 destroy_geoip();
1973
1974 restore_sysctl(&sysctl);
1975
1976 return 0;
1977 }
netsniff-ng toolkit, the packet sniffing beast, staging tree